84af6da5dda3d5b08c600f5f29566d62ec4d06e45a9aea4eca29a2d66b0acc91 | Triage

Sharing

General

Target

84af6da5dda3d5b08c600f5f29566d62ec4d06e45a9aea4eca29a2d66b0acc91
Size

38.7MB
Sample

241029-k7prcaspgw
MD5

e4dfcaa77516efd3b5a9c1cacd4c6e85
SHA1

a5e94d20fb88845fa3eec8b71852ec21fdb56f1b
SHA256

84af6da5dda3d5b08c600f5f29566d62ec4d06e45a9aea4eca29a2d66b0acc91
SHA512

3fe443c59cd1e7feabebc35b9afb11b38841e6ca30c2e95ac5a4a6b2427a8c27d1b8230e4e385e950aff1050aa3dcf62bb762a39226e89bdd93a01f499b4ed76
SSDEEP

786432:O0oC9my+gCXUxeEnw9laR9w+q9fYRTo2gNPPClDbkK68lhjHDT0//JXhLgTSGsfM:gCD+8xeEIY9wPVKlDbk0jjT0nJXlVX7o

Score

5^/10

discovery persistence privilege_escalation

Malware Config

Targets

- Target
  
  AbRoot.dll
- Size
  
  355KB
- MD5
  
  530957a391c6bc978ae7179179594b12
- SHA1
  
  f174b1575ebc2f6612272cf39215d5dc27ee6b38
- SHA256
  
  9fbeab4bcfcec34dc13cad90609101b2ea099069ab173555635f174597e4ea09
- SHA512
  
  9f3da37b8b8047bcc463c2d12360c6bc99bf35868a14222abb2108e103bab5355d1c069d5ac775bd3c7c953a9c8c3299bd61287c4fb7a074f36a4450e95368e2
- SSDEEP
  
  3072:mB16MsQd1V0rSJkRd2Ygeu1qs93J2FooJafVMkZuP9Dy4s5zTG22+xF0KA6ppDwZ:mBXT1V0WojDy4s5MQV0jw0
Score

1^/10
behavioral1 behavioral2
- Target
  
  AdTree.dll
- Size
  
  355KB
- MD5
  
  530957a391c6bc978ae7179179594b12
- SHA1
  
  f174b1575ebc2f6612272cf39215d5dc27ee6b38
- SHA256
  
  9fbeab4bcfcec34dc13cad90609101b2ea099069ab173555635f174597e4ea09
- SHA512
  
  9f3da37b8b8047bcc463c2d12360c6bc99bf35868a14222abb2108e103bab5355d1c069d5ac775bd3c7c953a9c8c3299bd61287c4fb7a074f36a4450e95368e2
- SSDEEP
  
  3072:mB16MsQd1V0rSJkRd2Ygeu1qs93J2FooJafVMkZuP9Dy4s5zTG22+xF0KA6ppDwZ:mBXT1V0WojDy4s5MQV0jw0
Score

1^/10
behavioral3 behavioral4
- Target
  
  QtCore4.dll
- Size
  
  2.5MB
- MD5
  
  8b7739ef8285cf5d7dd5afd6c7aabde0
- SHA1
  
  2d93b416493f2ed3b81a57649151596903e6fe7f
- SHA256
  
  bdb6698c579e8276ec19b2b2dcdd9ccafd4a293bbdf01a021f4d4cccd3459dbc
- SHA512
  
  af28e032d40c59b61de903e6744b660d5555d9fbcef42e6679f8bd6e34854c5851c93c1300537199f6470549aa0ec7e664b43fe2f31b4a2652b98047f7ccfab8
- SSDEEP
  
  49152:JTFgiFpGXOENKcgjGkJsv6tWKFdu9C6TELyvL/6mShMZtmjNUVrciV5P+7QVg07S:J+iDacjxJsv6tWKFdu9CZgfF
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  QtGui4.dll
- Size
  
  8.2MB
- MD5
  
  831ba3a8c9d9916bdf82e07a3e8338cc
- SHA1
  
  6c89fd258937427d14d5042736fdfccd0049f042
- SHA256
  
  d2c8c8b6cc783e4c00a5ef3365457d776dfc1205a346b676915e39d434f5a52d
- SHA512
  
  beda57851e0e3781ece1d0ee53a3f86c52ba99cb045943227b6c8fc1848a452269f2768bf4c661e27ddfbe436df82cfd1de54706d814f81797a13fefec4602c5
- SSDEEP
  
  98304:YxRJATZlLne1/cF6ZWHxD1HFH+J+70msIWeiLtRgi3d4PJpTcSqxyr:YxiZBG2xpljTcJy
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  
  QtNetwork4.dll
- Size
  
  1.0MB
- MD5
  
  8a2e025fd3ddd56c8e4f63416e46e2ec
- SHA1
  
  5f58feb11e84aa41d5548f5a30fc758221e9dd64
- SHA256
  
  52ae07d1d6a467283055a3512d655b6a43a42767024e57279784701206d97003
- SHA512
  
  8e3a449163e775dc000e9674bca81ffabc7fecd9278da5a40659620cfc9cc07f50cc29341e74176fe10717b2a12ea3d5148d1ffc906bc809b1cd5c8c59de7ba1
- SSDEEP
  
  12288:m+PpRNPe4+DZFvnwJ9o+Hllp59K03AskvvukLosiLHrv7F0YmIYunuGS:m+hRCZhwY+Hllp59OHvfo7HrCYmItnC
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  
  QtXml4.dll
- Size
  
  348KB
- MD5
  
  e9a9411d6f4c71095c996a406c56129d
- SHA1
  
  80b6eefc488a1bf983919b440a83d3c02f0319dd
- SHA256
  
  c9b2a31bfe75d1b25efcc44e1df773ab62d6d5c85ec5d0bc2dfe64129f8eab5e
- SHA512
  
  93bb3dd16de56e8bed5ac8da125681391c4e22f4941c538819ad4849913041f2e9bb807eb5570ee13da167cfecd7a08d16ad133c244eb6d25f596073626ce8a2
- SSDEEP
  
  6144:6gdDO1NTI8ew+Rh9CY8gjvXQ0AObEL9gqIL:6gda1FI8V+f9FFzA1IL
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  
  Set-up.exe
- Size
  
  6.2MB
- MD5
  
  11c8962675b6d535c018a63be0821e4c
- SHA1
  
  a150fa871e10919a1d626ffe37b1a400142f452b
- SHA256
  
  421e36788bfcb4433178c657d49aa711446b3a783f7697a4d7d402a503c1f273
- SHA512
  
  3973c23fc652e82f2415ff81f2756b55e46c6807cc4a8c37e5e31009cec45ab47c5d4228c03b5e3a972cacd6547cf0d3273965f263b1b2d608af89f5be6e459a
- SSDEEP
  
  98304:u4bRxuHuFP2rHLpHPA477yNRgoPbfnRROWR721LYfs17u0kcFrXLEJfwY:u4NxuOFI1AEyrbf/52BYfs1LkcFrXL+X
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  
  StarBurn.dll
- Size
  
  654KB
- MD5
  
  f75225db13e3b86477dc8658c63f9b99
- SHA1
  
  6ffd5596fd69e161b788001abab195cc609476cf
- SHA256
  
  4286cf3c1ed10b8d6e2794ab4ed1cfcded0ea40d6794016ce926cd9b547c6a00
- SHA512
  
  07dee210de39e9f303bb72558c4b2aeb5de597638f0a5bfdcbe8f8badfb46a45f7a1518726d543f18682214668d22586299159e2c3947a9285990867bc457327
- SSDEEP
  
  12288:1/gzbnbASodCXNn5FJX5KrN9VmoBBDFDn8j:FRSoSn5FJX5KZ9VmoDKj
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  
  msvcp100.dll
- Size
  
  411KB
- MD5
  
  03e9314004f504a14a61c3d364b62f66
- SHA1
  
  0aa3caac24fdf9d9d4c618e2bbf0a063036cd55d
- SHA256
  
  a3ba6421991241bea9c8334b62c3088f8f131ab906c3cc52113945d05016a35f
- SHA512
  
  2fcff4439d2759d93c57d49b24f28ae89b7698e284e76ac65fe2b50bdefc23a8cc3c83891d671de4e4c0f036cef810856de79ac2b028aa89a895bf35abff8c8d
- SSDEEP
  
  12288:iHEqYsrMWIqz473PTiPoH/aGhUgiW6QR7t5qv3Ooc8UHkC2eKq87:iH9YsIWIW4rPTiPofaDv3Ooc8UHkC2e8
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  
  msvcr100.dll
- Size
  
  752KB
- MD5
  
  67ec459e42d3081dd8fd34356f7cafc1
- SHA1
  
  1738050616169d5b17b5adac3ff0370b8c642734
- SHA256
  
  1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067
- SHA512
  
  9ed1c106df217e0b4e4fbd1f4275486ceba1d8a225d6c7e47b854b0b5e6158135b81be926f51db0ad5c624f9bd1d09282332cf064680dc9f7d287073b9686d33
- SSDEEP
  
  12288:fQmCy3NeRjkpQmj3oaMtQqjoygfXq3kon9IlbgaOxQdVJJ6j5EBKX8hR5:ImCy3VQs9MtLjTgfa3kon9FaOdEz5
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  
  opengl64.dll
- Size
  
  17.7MB
- MD5
  
  0a84667145e7efef026c888d4b768126
- SHA1
  
  27673e1bd7c55bba6eaa37620d3b3820ce45d46a
- SHA256
  
  dd575f3c64382193610815909bd2c52490244ecbbb9bba6eef5fe4f0bb43bb4d
- SHA512
  
  3e964c996ed358787c4dfdb965a00b38b4118c804ae1bf8d32aeb7d936584e72c188e3fa0d27d1c2ffd3be13dca8045b08b28b15070812c195d82d1bf23a2604
- SSDEEP
  
  393216:PXhbUNnoBP98OQ//aXUszfTBHCOUZ2UenCDkOH2:PXhNB4nlW
Score

1^/10
behavioral21 behavioral22
- Target
  
  updater/nvdisps.dll
- Size
  
  11.1MB
- MD5
  
  da3e5ecda1487fdbcc6d7db314815696
- SHA1
  
  b2775d5a94a2af489590e1544dbff7176c39d389
- SHA256
  
  77173b4b61b59eca507ca3ece87a77a87e4e77a48dd162ba813d61cb0513421d
- SHA512
  
  cb3a14dbb15fad5bee97f3ec2236c7946778b1c884b38086026029f1bbbf20648e420bd829a82b8796f420ee50a5ef896bdc9aaccc67b82ac4e89eb67294c656
- SSDEEP
  
  98304:XNTNmlyn5aaKgwF2MxtrjgEe2eVivataUN3Dumf/S+CJ4RoLERm6iVv/lraqXtxG:XNT8lxjVWiCwUN3d/RbCv/9tx/KLce3
Score

5^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral23 behavioral24
- Target
  
  updater/nvdispsr.dll
- Size
  
  11.0MB
- MD5
  
  d74d7dca89d97bc912a376a5c34172b1
- SHA1
  
  6420073ab703884dbacd499c1b7174f858e2068c
- SHA256
  
  0681d4e92b84d238b3e3fb118b0a359be1aba83528b94f7fde2d9101d8163417
- SHA512
  
  3e4a308794b05b9eb99902367ed8916a590316261175b02dd35007fabd900d715625e48aa0d5b5518f02550b0b678eb7ef83dc96f68632d93d21378351d82f2c
- SSDEEP
  
  98304:0lRaeidue2eFivataUN3Demf/S+CJ4RoLEROyiev/lraqXtx/SzLce3hNc:+CliCwUN3d/Rb5v/9tx/KLce3hNc
Score

1^/10
behavioral25 behavioral26
- Target
  
  updater/nvptxJitCompiler32.dll
- Size
  
  16.6MB
- MD5
  
  3ea5205d6831ddc3670ab8eeacb853f5
- SHA1
  
  dadb303e031089535ea01c8a10d89c1033a5d7a4
- SHA256
  
  caa6ae6c505e54875761443171c229ed367b2e51e448a9034b81be062b961847
- SHA512
  
  5e7118d3db968d30f7020fb5a3e4373acd1572eb7736f55229d1aba836e43b755cff2d78e7bd22daebec5a53bbcf7eaf00a0a5d233bc6679c36675a03bc1b36b
- SSDEEP
  
  196608:LeXcR+Vei+lHBfL90NUIE4/pp1D84she84lt7Hpml9DCqIsXC:Q5+7j9SG4lw4HDltLknc
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  
  x64/trading_api64.dll
- Size
  
  282KB
- MD5
  
  2bca4e2c047ec969cb3cff277e7fc184
- SHA1
  
  c4b5b00b605e59c6fdcb6731f2e53069506e287a
- SHA256
  
  f1eb582e607a1e43cdb1654bfb7cb29ad46f6728b3fb89a14f7727e0e8daab69
- SHA512
  
  3819178ec650298157b1d67317e0895cb92709b106d0d8525921e341eba5e960f42434e010066bb405f1ba1619adff1a645ede58e16c4b2d88df2c90611a6cb5
- SSDEEP
  
  6144:Aa0EKzmilQBrUssevOkHcAxilMrCynC0bcLd1x:B0EZbr3se1SynC9x
Score

1^/10
behavioral29 behavioral30
- Target
  
  x64/tradingnetworkingsockets.dll
- Size
  
  4.1MB
- MD5
  
  3cf26ce759c5e261fe3ecc6451b8b08e
- SHA1
  
  b5da110034fe394a4020367404534903764473fe
- SHA256
  
  fc4a65ff603bf1f4bfe323de1866145ae1e006aa656799fd134dfa63d92d47c1
- SHA512
  
  e7b543483f38bb6338490b5c8f5da6f95e0d78b45f2b26d898cc3b58cf7c359952bfe413414cb6cd1532c3c6fd7a860026b2bec7b6d0ddfbee9a1385a62e14f2
- SSDEEP
  
  49152:kGtlqhcIU6ilVwASObX9F+LWDumqrJjAZVT4kmrqEUAYVxkG3q+XRQsmqkALD4z4:M+dl7+8z1mqkA8lv0bH1bBGZZs
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

Component Object Model Hijacking

Privilege Escalation

Event Triggered Execution

Component Object Model Hijacking

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

persistenceprivilege_escalation

behavioral24

persistenceprivilege_escalation

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32